name: Build HealthChat Desktop # Builds the HealthChat desktop (Electron) app for Linux, macOS and Windows: the fork's # element-web webapp with the HealthChat plugin (healthchat-module.js + healthchat-elements.js) # injected, packaged via the element-desktop build pipeline and published to the GitHub Release. # # This is the desktop counterpart of build-healthchat.yaml (web). On a `healthchat-v*` tag it # runs alongside the web build; it first builds the element-plugin from healthchat-workspace, # builds the fork webapp with the plugin injected, then feeds it into build_desktop_prepare.yaml # (via `webapp-artifact`) and the per-platform build_desktop_{linux,macos,windows}.yaml reusables. # # Notes: # - The reusable build workflows are pointed at THIS fork (repository/ref inputs) so the Electron # shell, icons (apps/desktop/build/icon.*) and the healthchat:// deep-link handler # (apps/desktop/src/protocol.ts) are all fork-branded. Branding values come from # apps/desktop/element.io/healthchat/{build.json,config.json} (-> variant.json). # - macOS notarisation and Windows code-signing require the `Desktop Apple` / `Desktop eSigner` # GitHub environments (secrets/vars) to be configured. Without them the builds still run but # produce unsigned/untrusted output. See apps/desktop/element.io/healthchat/README. # - The desktop app version comes from apps/desktop/package.json (electron-builder), NOT the tag # (Windows squirrel rewrites any `version` override into a nightly string). Bump # apps/desktop/package.json in the release commit if you want it to match the tag. on: push: tags: - "healthchat-v*" workflow_dispatch: inputs: version: description: "Version (e.g. 1.4.0). Used for the web bundle version; the desktop app version comes from apps/desktop/package.json." required: true type: string workspace_ref: description: "healthchat-workspace ref (defaults to .healthchat-workspace-version)." required: false type: string permissions: {} concurrency: group: build-healthchat-desktop-${{ github.event.inputs.version || github.ref_name }} cancel-in-progress: false jobs: webapp: name: Build webapp + plugin runs-on: ubuntu-latest permissions: contents: read steps: - uses: actions/checkout@v4 with: persist-credentials: false - name: Resolve version id: version env: INPUT_VERSION: ${{ github.event.inputs.version }} run: | set -euo pipefail if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then VERSION="${GITHUB_REF_NAME#healthchat-v}" elif [[ -n "${INPUT_VERSION:-}" ]]; then VERSION="${INPUT_VERSION}" else echo "::error::No version available (not a tag push and no version input)" exit 1 fi if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then echo "::error::Invalid version '$VERSION'" exit 1 fi echo "version=$VERSION" >> "$GITHUB_OUTPUT" - name: Resolve workspace ref id: workspace env: OVERRIDE: ${{ github.event.inputs.workspace_ref }} run: | set -euo pipefail if [[ -n "$OVERRIDE" ]]; then REF="$OVERRIDE" elif [[ -f .healthchat-workspace-version ]]; then REF=$(head -n1 .healthchat-workspace-version | tr -d '[:space:]') [[ -n "$REF" ]] || { echo "::error::.healthchat-workspace-version is empty"; exit 1; } else echo "::error::.healthchat-workspace-version missing and no workspace_ref override provided" exit 1 fi echo "ref=$REF" >> "$GITHUB_OUTPUT" - name: Checkout healthchat-workspace uses: actions/checkout@v4 with: repository: Novaloop-AG/healthchat-workspace path: healthchat-workspace token: ${{ secrets.HEALTHCHAT_WORKSPACE_TOKEN }} ref: ${{ steps.workspace.outputs.ref }} persist-credentials: false - uses: pnpm/action-setup@v4 - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: 22 cache: "pnpm" - name: Install monorepo deps run: pnpm install --frozen-lockfile - name: Build element-plugin run: | cd healthchat-workspace/element-plugin npm ci npm run build cd module npm ci npm run build - name: Stage plugin artifacts run: | mkdir -p plugin-dist/elements cp healthchat-workspace/element-plugin/module/dist/healthchat-module.js plugin-dist/healthchat-module.js cp healthchat-workspace/element-plugin/dist/elements/browser/main.js plugin-dist/elements/healthchat-elements.js - name: Build webapp with plugin injected env: VERSION: ${{ steps.version.outputs.version }} run: ./apps/desktop/scripts/build-healthchat-webapp.sh - uses: actions/upload-artifact@v4 with: name: healthchat-webapp retention-days: 1 path: apps/desktop/webapp prepare: name: Prepare desktop asar needs: webapp permissions: contents: read uses: ./.github/workflows/build_desktop_prepare.yaml with: repository: ${{ github.repository }} ref: ${{ github.sha }} config: element.io/healthchat webapp-artifact: healthchat-webapp # 'develop' skips the upstream "[Release] Fetch release" / Debian changelog step, # which would look for a non-existent v release in this fork. version: develop nightly: false deploy: false linux: name: Linux ${{ matrix.arch }} needs: prepare strategy: matrix: arch: [amd64, arm64] uses: ./.github/workflows/build_desktop_linux.yaml with: repository: ${{ github.repository }} ref: ${{ github.sha }} arch: ${{ matrix.arch }} sqlcipher: static test: false macos: name: macOS needs: prepare uses: ./.github/workflows/build_desktop_macos.yaml secrets: inherit # zizmor: ignore[secrets-inherit] with: repository: ${{ github.repository }} ref: ${{ github.sha }} sign: true test: false targets: "dmg zip" windows: name: Windows ${{ matrix.arch }} needs: prepare strategy: matrix: arch: [x64, arm64] uses: ./.github/workflows/build_desktop_windows.yaml # element-desktop's Windows reusable signs via SSL.com eSigner CKA, whose secret names # differ from the org-level CodeSignTool secrets shared with the other Novaloop apps # (CKA needs no credential_id). Map them here. A trusted signature also requires the # repo/org variable ESIGNER_MODE=prod (otherwise the reusable falls back to the untrusted # sandbox demo cert). secrets: ESIGNER_USER_NAME: ${{ secrets.ESIGNER_USERNAME }} ESIGNER_USER_PASSWORD: ${{ secrets.ESIGNER_PASSWORD }} ESIGNER_USER_TOTP: ${{ secrets.ESIGNER_TOTP_SECRET }} with: repository: ${{ github.repository }} ref: ${{ github.sha }} arch: ${{ matrix.arch }} sign: true test: false targets: "squirrel msi" release: name: Publish to GitHub Release needs: [linux, macos, windows] # Only publish on a real tag push; manual workflow_dispatch runs build but do not publish. if: startsWith(github.ref, 'refs/tags/') runs-on: ubuntu-latest permissions: contents: write steps: - name: Download all build artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: path: dist-artifacts - name: Collect installers run: | set -euo pipefail mkdir -p release-files # macOS: .dmg installer + .zip (Squirrel.Mac update payload) find dist-artifacts -type f \( -iname '*.dmg' -o -iname '*-mac.zip' \) -exec cp -v {} release-files/ \; # Windows: per-machine MSI + Squirrel "Setup" installer find dist-artifacts -type f \( -iname '*.msi' -o -iname '* Setup*.exe' \) -exec cp -v {} release-files/ \; # Linux: portable tarball + Debian package find dist-artifacts -type f \( -iname '*.tar.gz' -o -iname '*.deb' \) -exec cp -v {} release-files/ \; echo "--- release files ---" ls -la release-files test -n "$(ls -A release-files)" || { echo "::error::No installer files collected"; exit 1; } - name: Upload to GitHub Release env: GH_TOKEN: ${{ github.token }} GH_REPO: ${{ github.repository }} TAG: ${{ github.ref_name }} run: | set -euo pipefail # The web workflow (build-healthchat.yaml) also creates this release for the same tag. # Create-if-missing (without touching existing notes) then upload --clobber so the two # workflows race safely regardless of ordering. gh release view "$TAG" >/dev/null 2>&1 || \ gh release create "$TAG" --title "$TAG" --notes "HealthChat desktop installers for $TAG" gh release upload "$TAG" release-files/* --clobber